Three ways to run with Venaera.

Engagements are sized by the volume of data you ingest, from an essential footprint through to fully customized enterprise coverage. There is no self-serve checkout here. Every scope is shaped with our team against your real estate, and the commitments are written down before you sign anything.

Sizing basis: Volume of data ingested
Engagements: Essential, Enhanced, Enterprise
Included throughout: Onboarding, management, training, reporting
Procurement: Scoped with our team, never automated

How sizing works

Priced on what we have to read, not on what you hope to spend.

The cost of managed detection and response is driven by one thing above all others: how much telemetry has to be ingested, enriched, retained, and reasoned over. That is why engagements scale with data volume rather than with seat counts, which have almost no relationship to the work involved.

We publish no price list because an honest number requires knowing your sources, your volumes, your retention obligations, and the response authority you want us to hold. A figure given before that conversation is either padded against unknowns or quietly incomplete.

What you will get, early and in writing, is a scope that states exactly what is covered, what is excluded, what the service targets are, and what happens when volumes grow.

Drives cost

Telemetry volume ingested, retention period, number and complexity of integrations, response authority granted, and the depth of custom detection engineering required.

Does not drive cost

Alert count. We will never bill you more because your infrastructure got noisier, which would make us the only party in the relationship rewarded by noise.

Volume growth

Handled with a stated band and a review trigger, so you are not surprised by a mid term charge when a new business unit comes online.

Contract length

Annual by default, with flexible terms available on enterprise engagements. Offboarding procedure and data deletion schedule are agreed at the start, not at the exit.

What is never extra

Onboarding, platform management, training for your staff, dashboards and reporting, and your customer success contact. Those are part of every engagement at every size.

Engagements

Pick the floor, then we size it.

These are coverage levels rather than product editions. The difference between them is how much of the estate is inside scope, how fast we commit to move, and how much engineering we dedicate to your environment specifically.

01 / Coverage

Essential

Core managed detection and response for teams establishing always-on coverage for the first time, or replacing a service that only forwards alerts.

Scales by data ingested · entry footprint

Sub minute AI triage on every alert from every connected source
Prioritized escalation to human analysts with reasoning attached
Complete alert coverage with the large majority of false positives removed
Core integrations across cloud, endpoint, identity, and email
Dashboards and reporting with weekly operations review
Guided response steps your team executes

Scope an Essential engagement

Around the clock 02 / Coverage

Enhanced

Around-the-clock coverage for higher data volumes, with full human and model watch at every hour and faster committed response.

Scales by data ingested · higher volume

Everything in Essential
24 / 7 / 365 analyst coverage with staffed shifts, not pager only
Automated remediation for pre-authorized containment actions
Expanded ingestion across network, SaaS, and business applications
Faster response targets on critical and high severity
Monthly posture review with your security lead

Scope an Enhanced engagement

03 / Coverage

Enterprise

Fully customized coverage for complex estates, with dedicated engineering, proprietary tool integration, and engagement at executive level.

Scales by data ingested · fully tailored

Everything in Enhanced
Dedicated security engineering assigned to your environment
Proprietary and custom tool integration with bespoke detection content
Custom detection development against your own abuse cases
Flexible contracting and negotiated service commitments
Executive briefings and board ready reporting

Scope an Enterprise engagement

Side by side

What changes between engagements.

Everything in this table is part of the written scope. Where a row says it is negotiated, that means it is set against your environment during scoping rather than left vague.

Engagement comparison
Capability	Essential	Enhanced	Enterprise
Sub minute AI triage, all alerts	Included	Included	Included
Complete alert coverage with suppression reasoning	Included	Included	Included
Human analyst confirmation on escalations	Included	Included	Included
Analyst coverage window	Business hours, with out of hours escalation on critical	24 / 7 / 365 staffed shifts	24 / 7 / 365 staffed shifts
Automated remediation execution	Guided response only	Pre-authorized actions	Pre-authorized actions
Integration breadth	Cloud, endpoint, identity, email	Adds network, SaaS, business applications	Adds proprietary and custom systems
Custom detection development	Standard content	Tuning and environment specific exceptions	Bespoke content and engineering
Dedicated security engineering	Not included	Shared pool	Assigned to your estate
Reporting cadence	Weekly operations review, monthly summary	Adds monthly posture review	Adds quarterly executive and board reporting
Post incident review	Written record on material incidents	Review session with your team	Full review with remediation programme
Service commitments	Standard targets	Faster targets on critical and high	Negotiated and contractually committed
Onboarding, management, training, success contact	Included	Included	Included

Every engagement includes

Five things that are never a line item.

Plenty of providers price these separately and discover them during implementation. They are part of the service at every coverage level, because a detection platform nobody deployed properly protects nothing.

Deployment and onboarding

Stand up, integration, baselining, and tuning to your environment from day one, run by our team rather than handed to yours as a project.

Platform management

We run, monitor, patch, and maintain the platform and every connector. Source health is audited weekly so silent ingestion failure gets caught.

Training

Enablement for your security and IT staff: how escalations arrive, how to work a guided response, and how to read what the platform tells you.

Dashboards and reporting

Operational, tactical, and strategic reporting with audit ready evidence of monitoring and response, available without a special request.

Customer success

A named point of contact who knows your environment, owns the relationship, and is measured on your security outcomes rather than on upsell.

Service targets

The clock, and who is holding it.

Triage is continuous and automatic at every level, so the number that varies between engagements is how fast a human reaches a confirmed threat and how much we are authorized to do on our own. Targets below are standing commitments. Enterprise engagements negotiate their own.

Standing service targets by severity and engagement
Severity	AI triage	Essential, analyst engaged	Enhanced, analyst engaged	Client contact
Critical	Under 60 seconds	Within 30 minutes, any hour	Within 15 minutes, any hour	Direct call to your escalation contact
High	Under 60 seconds	Within 2 hours on shift	Within 30 minutes, any hour	Agreed channel with written summary
Medium	Under 60 seconds	Same business day	Within 4 hours	Daily digest unless it escalates
Low	Under 60 seconds	Reviewed in batch	Reviewed in batch	Dashboard and weekly reporting
Suppressed	Under 60 seconds	Class audited weekly	Class audited weekly	Queryable any time, summarized monthly

Targets are confirmed in your engagement scope and measured as a distribution rather than an average.

Onboarding

Live coverage inside the first month.

Deployment is sequenced so that the highest value coverage goes live first rather than waiting for the whole estate to be perfect. You get real monitoring in week one and the long tail follows.

Timelines below describe a typical Enhanced engagement. Complex estates and heavily regulated environments run longer, and we will say so during scoping rather than discovering it in week three.

Week 1

Core integrations live

Cloud, endpoint, identity, and email connected with scoped read credentials. Triage begins immediately. Escalation paths and standing authority agreed in writing with your team.

Weeks 2 to 3

Baseline and expand

Remaining sources connected. Maintenance windows, service account behaviour, and legitimate administrative patterns captured with your engineers. Suppression classes reviewed together.

Week 4

Full coverage and response authority

Detection content tuned to your baseline. Response permissions enabled for the action classes you approved. First weekly operations review. Training delivered to your staff.

Days 30 to 90

Precision work

The period where the service gets noticeably sharper on your estate: false positive classes eliminated, environment specific detections written, and coverage gaps from the source audit closed.

Ongoing

Steady state

Continuous tuning, weekly source health audits, monthly posture review, quarterly reporting, and detection content tracking new attacker technique as it emerges.

Questions we are asked first

Before the briefing.

The answers prospective clients usually want before they spend an hour with us.

Do you replace our existing security tools?

No. Venaera integrates with the tools you already run and orchestrates across them. Your endpoint platform, identity provider, cloud security services, and email protection stay exactly where they are, and we read from them and act through them.

If a tool in your estate is genuinely not worth keeping we will say so during scoping, but replacing it is your decision and not a condition of the engagement.

Do you replace our security team?

No, and we would consider that a failure of the service. Venaera is built to make a small internal team effective against an estate that would otherwise require a department. Your people keep the institutional knowledge, the business relationships, and the architectural decisions. We take the continuous watch, the triage volume, and the out of hours burden.

What can the platform do without asking us first?

Exactly what you authorize in writing during onboarding, and nothing more. Most clients pre-authorize endpoint isolation, session revocation, and forced credential reset, because those are reversible and the cost of delay is high. Production network changes, service account disablement, and anything touching a critical business process typically require a call.

Standing authority can start at zero. Several clients run guided response only for the first month and expand once they have watched how we work.

What happens if you miss something?

We tell you, in writing, with the timeline and the reason. Missed detections get a root cause review the same way incidents do: whether the signal was absent, the source was unhealthy, the detection did not exist, or the verdict was wrong. The resulting fix is tracked to completion and reported to you.

Any provider who has never missed anything is either very new or not being straight with you. What matters is whether the failure is found, explained, and closed.

How quickly can we go live?

Core coverage across cloud, endpoint, identity, and email is typically live within the first week of deployment, and full coverage within the first month for a standard estate. The gating factor is almost always credential issuance and internal approvals on your side rather than engineering work on ours.

Can you work alongside an existing managed provider?

Yes, and it is a common transition pattern. We run in parallel during a defined overlap so you can compare what each service catches and escalates on the same telemetry, then cut over with no coverage gap. We will not use that period to disparage the incumbent, and the comparison speaks for itself.

Do we need to send you all our logs?

Not necessarily. Where you already normalize and retain centrally, we read from that pipeline rather than building a second one, so you are not paying twice to store the same bytes. Where a source has a usable API we pull directly from it. Scope is minimized to what detection actually requires.

What does leaving look like?

A documented procedure agreed at the start of the engagement, not a negotiation at the end. Integrations are disconnected, the credentials you issued are revoked, your telemetry is deleted on the agreed schedule, and you receive an exportable record of monitoring, alert disposition, and incidents before access ends.

Request a briefing

Let us size this properly.

Tell us your sources, your rough ingest volume, and the coverage you need. We will come back with a scope, the service targets, and a straight answer on cost rather than a range designed to get a second meeting.

Scope your coverage Response within one business day